AIX

 View Only
  • 1.  /var 100% full

    Posted Tue September 20, 2022 10:01 AM
    Hello All, 

    Would you  please advise me what should I do /var filesystem is getting full whenever I extend its size. 

    Regards 
    Honore 


  • 2.  RE: /var 100% full

    Posted Tue September 20, 2022 11:30 AM
    If its filling up quickly after you extend it, then something has written to it.

    use this command (find /var -xdev -mmin -15 -ls)
    this will files that have been modified within the last 15 minutes

    check /var/spool/mail, /var/tmp and wherever your syslog files go (check /etc/syslog.conf)

    files that show up with the find command, run through fuser and see if there are any active processes (syslogd will be expected).
    if you find files in /var/spool/mail or /var/spool/mqueue that are too big to go through the mail system, you may want to remove them

    ALWAYS check fuser results before removing files. removing an active file does not free the space until the process closes the file (usually by terminating)




  • 3.  RE: /var 100% full

    Posted Wed September 21, 2022 05:23 AM
    Dear Tom,
    Thanks for the communication.  I followed  it up but to no avail. I then  continued to o terminate all of the processes using a given file system, entered : fuser -k -x -u -c /dev/hd9var

    Kind regards
    Honore





  • 4.  RE: /var 100% full

    IBM Champion
    Posted Wed September 21, 2022 05:29 PM
    If killing the processes releases the space, then you have an unlinked file.

    You'll have to use lsof to see all the processes that are writing in /var, the use "find /var -xdev -inum 'inodenumber'" to find each file.  The ones that can't be found are the unlinked ones.    Check the applications with unlinked files.

    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------



  • 5.  RE: /var 100% full

    IBM Champion
    Posted Wed September 21, 2022 05:24 AM
    Edited by José Pina Coelho Wed September 21, 2022 05:25 PM

    Find the large files, figure out why they're growing, then address the cause and not the effect.


    Find largest files:

    find /var -xdev -ls | sort +6n 

    or go into /var and find out in which subdirectory you have the most usage:

    cd /var ; du -ms *

    Edit:

    - Beware of filesystems mounted under /var (du will descend into them, but you are looking for stuf in /var)

    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------



  • 6.  RE: /var 100% full

    Posted Wed September 21, 2022 11:06 AM
      |   view attached
    Full FSs are a common problem, so I developed a common tool to help me understand the reason why the FS is full. I have attached a shell script space_hogs that I use to perform an initial assessment. I usually start with the syntax:
    space_hogs -tMT 20 /var
    This will provide a sorted list of the top 20 largest files (in MBytes) along with a modification timestamp. It is typically immediately apparent from this information what the "culprit" is that is responsible for the rapid filling of the /var FS. You can pass '-h' to the script for more options.

    ------------------------------
    Mackey Morgan
    ------------------------------

    Attachment(s)

    txt
    space_hogs.txt   8 KB 1 version


  • 7.  RE: /var 100% full

    IBM Champion
    Posted Wed September 21, 2022 05:17 PM
    "Embellished the USAGE statement" <= Sounds like a PLET :-)

    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------